Diagnosing 100% CPU Usage on a VPS

A maxed-out CPU shows up as a slow website, laggy SSH typing and timed-out cron jobs. The cause may be legitimate growth, a runaway program, or even a crypto-mining trojan. Here is the diagnostic order.

Step 1: identify the consumer

Run top (press P to sort by CPU) or the friendlier htop, and note the top process name and PID. Three scenarios:

• A business process you recognize (mysql, php-fpm, node...) → go to step 2;
• An unfamiliar or disguised name (random strings, kdevtmpfsi, xmrig...) → likely a mining trojan, jump to step 4;
• High iowait rather than user CPU (large wa value in top) → the real bottleneck is the disk; investigate disk IO instead.

Step 2: common causes for business processes

• MySQL: slow queries missing indexes. Enable the slow query log and add indexes to full-table scans;
• PHP / Node: infinite loops, or hammering by crawlers. Check access logs for abnormal high-frequency IPs and apply rate limiting or firewall bans;
• Stacked cron jobs: the next run starts before the last finishes and tasks pile up — guard scripts with a lock (flock).

Step 3: is the plan simply too small?

If the load average stays above your core count at peak while every process behaves normally, real traffic has outgrown the configuration. When little optimization headroom remains, upgrading CPU is the economical fix.

Step 4: handling a suspected mining trojan

Symptoms: CPU pinned at 100% around the clock, weird process names, processes that resurrect after being killed, unfamiliar crontab entries. Response order: cut the suspicious process off the network, inspect crontab -l and /etc/cron.* for foreign jobs, and check ~/.ssh/authorized_keys for injected public keys. Important: trojans are hard to remove completely — the safest path is to back up your data and reinstall the OS, then apply firewall and key-only login hardening as described in our security articles. Contact 00Shark support if you need help.